NigeriaNational Identity Management Commission Act, 2007, access to the National Identity Database and mandatory use of the National Identification Number
National Identity Management Commission Act, 2007 (Act No. 23 of 2007), ss. 26-30
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Access restriction, Consent, Prohibition
As of .
What it requires
- Do not access the data or information held in the National Identity Database for a registered individual except with the authorisation of the Commission, and only where the individual applied for it, or someone with the individual's authority did, or the individual consents to it being provided to you (section 26(1)).
- Do not access data or information contained in the Database without lawful authorisation (section 28(1)(a)).
- Where you are an authority or organisation to which a person applies to carry out a transaction listed in section 27(1), such as opening an individual bank account, purchasing an insurance policy or any consumer credit transaction, request the person to produce a Multi-purpose Identity Card or National Identification Number; the number must be presented for those transactions from the date specified in regulations made by the Commission (section 27(1) and (2)).
- Do not carry out, or permit the carrying out of, a transaction specified in section 27 without a National Identification Number (section 29).
- Do not refuse to accept a Multi-purpose Identity Card issued under the Act as sufficient identification of the person to whom it is issued (section 30(1)(j)).
- Provide the Commission with relevant data or information when it requires it, and do not knowingly or recklessly give it information that is false in a material particular (section 28(1)(b) and (c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 28(2) provides imprisonment for a term of not less than ten years without option of fine for accessing Database data without lawful authorisation, and a fine of not less than N250,000 or imprisonment for a term of not less than three years, or both, for the other offences in section 28(1). Section 28(3) provides, where a body corporate commits an offence under section 28(1)(a) with the connivance of or through the neglect of a director, manager or similar officer, imprisonment for ten years for that officer and a fine of N10,000,000 for the body corporate. Section 29 provides, for a body corporate that carries out a section 27 transaction without a National Identification Number, a fine of not less than N1,000,000, and a fine of N1,000,000 on each chief executive or line manager.
What this law does
Section 26(1) bars any person or body corporate from access to the data in the National Identity Database for a registered individual's entry except with the authorisation of the National Identity Management Commission, and only if the individual applied for the information or consented to its provision.
Section 27(1) requires the National Identification Number to be presented, from the date the Commission's regulations specify, for listed transactions including the opening of individual or personal bank accounts, the purchase of insurance policies and all consumer credit transactions. Section 27(2) requires any authority or organisation to which a person applies to carry out a listed transaction to request the person to produce a Multi-purpose Identity Card or National Identification Number.
Section 28(1) makes it an offence to access data or information contained in the Database without lawful authorisation, to refuse to provide relevant data or information to the Commission, or to give the Commission information that is false in a material particular knowingly or recklessly. Section 29 makes it an offence to carry out or permit the carrying out of a transaction specified in section 27 without a National Identification Number.
Section 30(1)(j) makes it an offence to refuse to accept a Multi-purpose Identity Card issued under the Act as sufficient identification of the person to whom it is issued.
When LexLint raises it
When your app profile says your app processes biometric data, is a bank, is an insurer or is a lender.